Expected behavior
Clients appear in the clients list at https://api.wikimedia.org/wiki/Special:AppManagement when logged in to both the API Portal and Meta. This behavior works as expected in the beta cluster.
Observed behavior
Clients do not appear in the client list, giving this error:
Access to XMLHttpRequest at 'https://meta.wikimedia.org/w/rest.php/oauth2/client?limit=5&oauth_version=2&sort=%7B%22property%22%3A%22registration%22%2C%22direction%22%3A%22DESC%22%7D' from origin 'https://api.wikimedia.org' has been blocked by CORS policy: The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'. The credentials mode of requests initiated by the XMLHttpRequest is controlled by the withCredentials attribute. load.php?lang=en&modules=jquery%2Coojs-ui-core%2Coojs-ui-widgets|skin.wikimediaapiportal.scripts&skin=wikimediaapiportal&version=1suhe:133 GET https://meta.wikimedia.org/w/rest.php/oauth2/client?limit=5&oauth_version=2&sort=%7B%22property%22%3A%22registration%22%2C%22direction%22%3A%22DESC%22%7D net::ERR_FAILED
This is the same error we get in the beta cluster when encountering T264637. Interestingly, calling the endpoint directly in the browser (https://meta.wikimedia.org/w/rest.php/oauth2/client?limit=5&oauth_version=2&sort=%7B%22property%22%3A%22registration%22%2C%22direction%22%3A%22DESC%22%7D) does work.